* [nft PATCH 0/2] Some fixes for nested sets
@ 2017-03-20 16:38 Phil Sutter
2017-03-20 16:38 ` [nft PATCH 1/2] evaluate: set: Allow for set elems to be sets Phil Sutter
` (2 more replies)
0 siblings, 3 replies; 11+ messages in thread
From: Phil Sutter @ 2017-03-20 16:38 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
This series fixes a number of issues with nested anonymous sets.
Phil Sutter (2):
evaluate: set: Allow for set elems to be sets
evaluate: set: Fix nested set merge size adjustment
src/evaluate.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--
2.11.0
^ permalink raw reply [flat|nested] 11+ messages in thread* [nft PATCH 1/2] evaluate: set: Allow for set elems to be sets 2017-03-20 16:38 [nft PATCH 0/2] Some fixes for nested sets Phil Sutter @ 2017-03-20 16:38 ` Phil Sutter 2017-03-20 16:38 ` [nft PATCH 2/2] evaluate: set: Fix nested set merge size adjustment Phil Sutter 2017-03-21 13:19 ` [nft PATCH 0/2] Some fixes for nested sets Pablo Neira Ayuso 2 siblings, 0 replies; 11+ messages in thread From: Phil Sutter @ 2017-03-20 16:38 UTC (permalink / raw) To: Pablo Neira Ayuso; +Cc: netfilter-devel Recursive use of sets is handled in parts by parser_bison.y, which has a rule for inline unnamed sets in set_list_member_expr, e.g. like this: | add rule ip saddr { { 1.1.1.0, 2.2.2.0 }, 3.3.3.0 } Yet there is another way to have an unnamed set inline, which is via define: | define myset = { | 1.1.1.0, | 2.2.2.0, | } | add rule ip saddr { $myset, 3.3.3.0 } This didn't work because the inline set comes in as EXPR_SET_ELEM with EXPR_SET as key. This patch handles that case by replacing the former by a copy of the latter, so the following set list merging can take place. Signed-off-by: Phil Sutter <phil@nwl.cc> --- src/evaluate.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/evaluate.c b/src/evaluate.c index 8fb716c062449..86ff8ebd17629 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1132,6 +1132,15 @@ static int expr_evaluate_set(struct eval_ctx *ctx, struct expr **expr) return expr_error(ctx->msgs, i, "Set reference cannot be part of another set"); + if (i->ops->type == EXPR_SET_ELEM && + i->key->ops->type == EXPR_SET) { + struct expr *new = expr_clone(i->key); + + list_replace(&i->list, &new->list); + expr_free(i); + i = new; + } + if (!expr_is_constant(i)) return expr_error(ctx->msgs, i, "Set member is not constant"); -- 2.11.0 ^ permalink raw reply related [flat|nested] 11+ messages in thread
* [nft PATCH 2/2] evaluate: set: Fix nested set merge size adjustment 2017-03-20 16:38 [nft PATCH 0/2] Some fixes for nested sets Phil Sutter 2017-03-20 16:38 ` [nft PATCH 1/2] evaluate: set: Allow for set elems to be sets Phil Sutter @ 2017-03-20 16:38 ` Phil Sutter 2017-03-21 13:19 ` [nft PATCH 0/2] Some fixes for nested sets Pablo Neira Ayuso 2 siblings, 0 replies; 11+ messages in thread From: Phil Sutter @ 2017-03-20 16:38 UTC (permalink / raw) To: Pablo Neira Ayuso; +Cc: netfilter-devel When merging a nested set into the parent one, we are actually replacing one item with the items of the nested set. Therefore we have to remove the replaced item from size. The respective bug isn't as easy to trigger, since the size field seems to be relevant only when set elements are ranges which are checked for overlaps. Here's an example of how to trigger it: | add rule ip saddr { { 1.1.1.0/24, 3.3.3.0/24 }, 2.2.2.0/24 } Signed-off-by: Phil Sutter <phil@nwl.cc> --- src/evaluate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/evaluate.c b/src/evaluate.c index 86ff8ebd17629..b5db724cbd37b 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1149,7 +1149,7 @@ static int expr_evaluate_set(struct eval_ctx *ctx, struct expr **expr) /* Merge recursive set definitions */ list_splice_tail_init(&i->expressions, &i->list); list_del(&i->list); - set->size += i->size; + set->size += i->size - 1; set->set_flags |= i->set_flags; expr_free(i); } else if (!expr_is_singleton(i)) -- 2.11.0 ^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [nft PATCH 0/2] Some fixes for nested sets 2017-03-20 16:38 [nft PATCH 0/2] Some fixes for nested sets Phil Sutter 2017-03-20 16:38 ` [nft PATCH 1/2] evaluate: set: Allow for set elems to be sets Phil Sutter 2017-03-20 16:38 ` [nft PATCH 2/2] evaluate: set: Fix nested set merge size adjustment Phil Sutter @ 2017-03-21 13:19 ` Pablo Neira Ayuso 2017-03-22 0:26 ` [nft PATCH 1/3] tests: Add test cases for nested anonymous sets Phil Sutter 2 siblings, 1 reply; 11+ messages in thread From: Pablo Neira Ayuso @ 2017-03-21 13:19 UTC (permalink / raw) To: Phil Sutter; +Cc: netfilter-devel On Mon, Mar 20, 2017 at 05:38:54PM +0100, Phil Sutter wrote: > This series fixes a number of issues with nested anonymous sets. Series applied. Phil, I'd appreciate if you can follow up with a patch that adds tests/shell to cover this fix. Thanks. ^ permalink raw reply [flat|nested] 11+ messages in thread
* [nft PATCH 1/3] tests: Add test cases for nested anonymous sets 2017-03-21 13:19 ` [nft PATCH 0/2] Some fixes for nested sets Pablo Neira Ayuso @ 2017-03-22 0:26 ` Phil Sutter 2017-03-22 0:26 ` [nft PATCH 2/3] tests: shell: netns/0003many_0: Fix cleanup after error Phil Sutter ` (2 more replies) 0 siblings, 3 replies; 11+ messages in thread From: Phil Sutter @ 2017-03-22 0:26 UTC (permalink / raw) To: Pablo Neira Ayuso; +Cc: netfilter-devel This makes sure nesting of anonymous sets works regardless of whether defines are used or not. As a side-effect, it also checks that overlap checking when IP address prefixes are used, works. Signed-off-by: Phil Sutter <phil@nwl.cc> --- tests/py/ip/sets.t | 4 +++ tests/py/ip/sets.t.payload.inet | 19 +++++++++++++ tests/py/ip/sets.t.payload.ip | 15 +++++++++++ tests/py/ip/sets.t.payload.netdev | 19 +++++++++++++ tests/shell/testcases/sets/0021nesting_0 | 46 ++++++++++++++++++++++++++++++++ 5 files changed, 103 insertions(+) create mode 100755 tests/shell/testcases/sets/0021nesting_0 diff --git a/tests/py/ip/sets.t b/tests/py/ip/sets.t index 4cca02b61ff04..4d14e8253e528 100644 --- a/tests/py/ip/sets.t +++ b/tests/py/ip/sets.t @@ -46,3 +46,7 @@ ip saddr != @set33 drop;fail ?set4 192.168.2.0/24;ok ?set4 192.168.1.1;fail ?set4 192.168.3.0/24;ok + +# test nested anonymous sets +ip saddr { { 1.1.1.0, 3.3.3.0 }, 2.2.2.0 };ok;ip saddr { 1.1.1.0, 2.2.2.0, 3.3.3.0 } +ip saddr { { 1.1.1.0/24, 3.3.3.0/24 }, 2.2.2.0/24 };ok;ip saddr { 1.1.1.0/24, 2.2.2.0/24, 3.3.3.0/24 } diff --git a/tests/py/ip/sets.t.payload.inet b/tests/py/ip/sets.t.payload.inet index 6d8d6bc3bbce6..35f699c7a13b4 100644 --- a/tests/py/ip/sets.t.payload.inet +++ b/tests/py/ip/sets.t.payload.inet @@ -30,3 +30,22 @@ inet test-inet input [ lookup reg 1 set set2 0x1 ] [ immediate reg 0 drop ] +# ip saddr { { 1.1.1.0, 3.3.3.0 }, 2.2.2.0 } +__set%d t 3 +__set%d t 0 + element 00010101 : 0 [end] element 00030303 : 0 [end] element 00020202 : 0 [end] +inet test-inet input + [ meta load nfproto => reg 1 ] + [ cmp eq reg 1 0x00000002 ] + [ payload load 4b @ network header + 12 => reg 1 ] + [ lookup reg 1 set __set%d ] + +# ip saddr { { 1.1.1.0/24, 3.3.3.0/24 }, 2.2.2.0/24 } +__set%d t 7 +__set%d t 0 + element 00000000 : 1 [end] element 00010101 : 0 [end] element 00020101 : 1 [end] element 00020202 : 0 [end] element 00030202 : 1 [end] element 00030303 : 0 [end] element 00040303 : 1 [end] +inet test-inet input + [ meta load nfproto => reg 1 ] + [ cmp eq reg 1 0x00000002 ] + [ payload load 4b @ network header + 12 => reg 1 ] + [ lookup reg 1 set __set%d ] diff --git a/tests/py/ip/sets.t.payload.ip b/tests/py/ip/sets.t.payload.ip index 858a5e1c6bb3e..891a1ee404c7f 100644 --- a/tests/py/ip/sets.t.payload.ip +++ b/tests/py/ip/sets.t.payload.ip @@ -22,3 +22,18 @@ ip test-ip4 input [ lookup reg 1 set set2 0x1 ] [ immediate reg 0 drop ] +# ip saddr { { 1.1.1.0, 3.3.3.0 }, 2.2.2.0 } +__set%d test-ip4 3 +__set%d test-ip4 0 + element 00010101 : 0 [end] element 00030303 : 0 [end] element 00020202 : 0 [end] +ip test-ip4 input + [ payload load 4b @ network header + 12 => reg 1 ] + [ lookup reg 1 set __set%d ] + +# ip saddr { { 1.1.1.0/24, 3.3.3.0/24 }, 2.2.2.0/24 } +__set%d test-ip4 7 +__set%d test-ip4 0 + element 00000000 : 1 [end] element 00010101 : 0 [end] element 00020101 : 1 [end] element 00020202 : 0 [end] element 00030202 : 1 [end] element 00030303 : 0 [end] element 00040303 : 1 [end] +ip test-ip4 input + [ payload load 4b @ network header + 12 => reg 1 ] + [ lookup reg 1 set __set%d ] diff --git a/tests/py/ip/sets.t.payload.netdev b/tests/py/ip/sets.t.payload.netdev index 87d54a0f4813e..ae8b6e7c8c46f 100644 --- a/tests/py/ip/sets.t.payload.netdev +++ b/tests/py/ip/sets.t.payload.netdev @@ -30,3 +30,22 @@ netdev test-netdev ingress [ lookup reg 1 set set2 0x1 ] [ immediate reg 0 drop ] +# ip saddr { { 1.1.1.0, 3.3.3.0 }, 2.2.2.0 } +__set%d test-netdev 3 +__set%d test-netdev 0 + element 00010101 : 0 [end] element 00030303 : 0 [end] element 00020202 : 0 [end] +netdev test-netdev ingress + [ meta load protocol => reg 1 ] + [ cmp eq reg 1 0x00000008 ] + [ payload load 4b @ network header + 12 => reg 1 ] + [ lookup reg 1 set __set%d ] + +# ip saddr { { 1.1.1.0/24, 3.3.3.0/24 }, 2.2.2.0/24 } +__set%d test-netdev 7 +__set%d test-netdev 0 + element 00000000 : 1 [end] element 00010101 : 0 [end] element 00020101 : 1 [end] element 00020202 : 0 [end] element 00030202 : 1 [end] element 00030303 : 0 [end] element 00040303 : 1 [end] +netdev test-netdev ingress + [ meta load protocol => reg 1 ] + [ cmp eq reg 1 0x00000008 ] + [ payload load 4b @ network header + 12 => reg 1 ] + [ lookup reg 1 set __set%d ] diff --git a/tests/shell/testcases/sets/0021nesting_0 b/tests/shell/testcases/sets/0021nesting_0 new file mode 100755 index 0000000000000..3bcb61473198c --- /dev/null +++ b/tests/shell/testcases/sets/0021nesting_0 @@ -0,0 +1,46 @@ +#!/bin/bash + +set -e + +tmpfile=$(mktemp) +if [ ! -w $tmpfile ] ; then + echo "Failed to create tmp file" >&2 + exit 0 +fi + +#trap "rm -rf $tmpfile" EXIT # cleanup if aborted + +RULESET=' +define set1 = { + 2.2.2.0/24, +} +define set2 = { + $set1, + 1.1.1.0/24 +} +table ip x { + chain y { + ip saddr { 3.3.3.0/24, $set2 } + } +}' + +echo "$RULESET" > $tmpfile +$NFT -f $tmpfile +if [ $? -ne 0 ] ; then + echo "E: unable to load ruleset" >&2 + exit 1 +fi + +EXPECTED="table ip x { + chain y { + ip saddr { 1.1.1.0/24, 2.2.2.0/24, 3.3.3.0/24} + } +}" + +GET="$($NFT list ruleset)" + +if [ "$EXPECTED" != "$GET" ] ; then + DIFF="$(which diff)" + [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET") + exit 1 +fi -- 2.11.0 ^ permalink raw reply related [flat|nested] 11+ messages in thread
* [nft PATCH 2/3] tests: shell: netns/0003many_0: Fix cleanup after error 2017-03-22 0:26 ` [nft PATCH 1/3] tests: Add test cases for nested anonymous sets Phil Sutter @ 2017-03-22 0:26 ` Phil Sutter 2017-03-22 8:45 ` Arturo Borrero Gonzalez 2017-03-22 11:51 ` Pablo Neira Ayuso 2017-03-22 0:26 ` [nft PATCH 3/3] sets: Fix for missing space after last element Phil Sutter 2017-03-22 11:51 ` [nft PATCH 1/3] tests: Add test cases for nested anonymous sets Pablo Neira Ayuso 2 siblings, 2 replies; 11+ messages in thread From: Phil Sutter @ 2017-03-22 0:26 UTC (permalink / raw) To: Pablo Neira Ayuso; +Cc: netfilter-devel If rule set applying failed, this would leave a stray netns in place. Interestingly, this situation led to other, seemingly unrelated testcases to fail with spurious errors, e.g. sets/0015rulesetflush_0: | $ ./run-tests.sh testcases/sets/0015rulesetflush_0 | I: using nft binary ../../src/nft | | W: [FAILED] testcases/sets/0015rulesetflush_0: expected 0 but got 1 | /tmp/tmp.BY7cuUYL8f:5:1-2: Error: Could not process rule: Operation not supported | table inet filter { | ^^ | /tmp/tmp.BY7cuUYL8f:9:1-2: Error: Could not process rule: No such file or directory | add element inet filter blacklist_v4 { | ^^ | /tmp/tmp.BY7cuUYL8f:5:1-2: Error: Could not process rule: Operation not supported | table inet filter { | ^^ | /tmp/tmp.BY7cuUYL8f:9:1-2: Error: Could not process rule: No such file or directory | add element inet filter blacklist_v4 { | ^^ | | I: results: [OK] 0 [FAILED] 1 [TOTAL] 1 | | $ ip netns list | 1_0003many_0 | $ ip netns del 1_0003many_0 | | $ ./run-tests.sh testcases/sets/0015rulesetflush_0 | I: using nft binary ../../src/nft | | I: [OK] testcases/sets/0015rulesetflush_0 | | I: results: [OK] 1 [FAILED] 0 [TOTAL] 1 Signed-off-by: Phil Sutter <phil@nwl.cc> --- tests/shell/testcases/netns/0003many_0 | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/shell/testcases/netns/0003many_0 b/tests/shell/testcases/netns/0003many_0 index f8853ee5a98c2..17d7b93588f34 100755 --- a/tests/shell/testcases/netns/0003many_0 +++ b/tests/shell/testcases/netns/0003many_0 @@ -109,6 +109,7 @@ function test_netns() echo "E: ruleset in netns $NETNS_NAME differs from the loaded" >&2 DIFF="$(which diff)" [ -x $DIFF ] && $DIFF -u <(echo "$RULESET") <(echo "$KERNEL_RULESET") + $IP netns del $NETNS_NAME exit 1 fi -- 2.11.0 ^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [nft PATCH 2/3] tests: shell: netns/0003many_0: Fix cleanup after error 2017-03-22 0:26 ` [nft PATCH 2/3] tests: shell: netns/0003many_0: Fix cleanup after error Phil Sutter @ 2017-03-22 8:45 ` Arturo Borrero Gonzalez 2017-03-22 11:51 ` Pablo Neira Ayuso 1 sibling, 0 replies; 11+ messages in thread From: Arturo Borrero Gonzalez @ 2017-03-22 8:45 UTC (permalink / raw) To: Phil Sutter; +Cc: Netfilter Development Mailing list On 22 March 2017 at 01:26, Phil Sutter <phil@nwl.cc> wrote: > If rule set applying failed, this would leave a stray netns in place. > Thanks Phil. Acked-by: Arturo Borrero Gonzalez <arturo@debian.org> ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [nft PATCH 2/3] tests: shell: netns/0003many_0: Fix cleanup after error 2017-03-22 0:26 ` [nft PATCH 2/3] tests: shell: netns/0003many_0: Fix cleanup after error Phil Sutter 2017-03-22 8:45 ` Arturo Borrero Gonzalez @ 2017-03-22 11:51 ` Pablo Neira Ayuso 1 sibling, 0 replies; 11+ messages in thread From: Pablo Neira Ayuso @ 2017-03-22 11:51 UTC (permalink / raw) To: Phil Sutter; +Cc: netfilter-devel On Wed, Mar 22, 2017 at 01:26:35AM +0100, Phil Sutter wrote: > If rule set applying failed, this would leave a stray netns in place. > > Interestingly, this situation led to other, seemingly unrelated > testcases to fail with spurious errors, e.g. sets/0015rulesetflush_0: > > | $ ./run-tests.sh testcases/sets/0015rulesetflush_0 > | I: using nft binary ../../src/nft > | > | W: [FAILED] testcases/sets/0015rulesetflush_0: expected 0 but got 1 > | /tmp/tmp.BY7cuUYL8f:5:1-2: Error: Could not process rule: Operation not supported > | table inet filter { > | ^^ > | /tmp/tmp.BY7cuUYL8f:9:1-2: Error: Could not process rule: No such file or directory > | add element inet filter blacklist_v4 { > | ^^ > | /tmp/tmp.BY7cuUYL8f:5:1-2: Error: Could not process rule: Operation not supported > | table inet filter { > | ^^ > | /tmp/tmp.BY7cuUYL8f:9:1-2: Error: Could not process rule: No such file or directory > | add element inet filter blacklist_v4 { > | ^^ > | > | I: results: [OK] 0 [FAILED] 1 [TOTAL] 1 > | > | $ ip netns list > | 1_0003many_0 > | $ ip netns del 1_0003many_0 > | > | $ ./run-tests.sh testcases/sets/0015rulesetflush_0 > | I: using nft binary ../../src/nft > | > | I: [OK] testcases/sets/0015rulesetflush_0 > | > | I: results: [OK] 1 [FAILED] 0 [TOTAL] 1 Also applied, thanks. ^ permalink raw reply [flat|nested] 11+ messages in thread
* [nft PATCH 3/3] sets: Fix for missing space after last element 2017-03-22 0:26 ` [nft PATCH 1/3] tests: Add test cases for nested anonymous sets Phil Sutter 2017-03-22 0:26 ` [nft PATCH 2/3] tests: shell: netns/0003many_0: Fix cleanup after error Phil Sutter @ 2017-03-22 0:26 ` Phil Sutter 2017-03-22 11:52 ` Pablo Neira Ayuso 2017-03-22 11:51 ` [nft PATCH 1/3] tests: Add test cases for nested anonymous sets Pablo Neira Ayuso 2 siblings, 1 reply; 11+ messages in thread From: Phil Sutter @ 2017-03-22 0:26 UTC (permalink / raw) To: Pablo Neira Ayuso; +Cc: netfilter-devel Not having a space between the last element in a set and the closing curly brace looks ugly, so add it here. This also adjusts all shell testcases as they match whitespace in nft output and therefore fail otherwise. Signed-off-by: Phil Sutter <phil@nwl.cc> --- src/expression.c | 2 +- tests/shell/testcases/maps/0003map_add_many_elements_0 | 2 +- tests/shell/testcases/maps/0004interval_map_create_once_0 | 2 +- .../testcases/maps/0005interval_map_add_many_elements_0 | 2 +- tests/shell/testcases/maps/0006interval_map_overlap_0 | 2 +- tests/shell/testcases/netns/0001nft-f_0 | 12 ++++++------ tests/shell/testcases/netns/0002loosecommands_0 | 4 ++-- tests/shell/testcases/netns/0003many_0 | 12 ++++++------ tests/shell/testcases/nft-f/0002rollback_rule_0 | 4 ++-- tests/shell/testcases/nft-f/0003rollback_jump_0 | 4 ++-- tests/shell/testcases/nft-f/0004rollback_set_0 | 4 ++-- tests/shell/testcases/nft-f/0005rollback_map_0 | 6 +++--- tests/shell/testcases/sets/0021nesting_0 | 2 +- tests/shell/testcases/transactions/0035set_0 | 2 +- tests/shell/testcases/transactions/0038set_0 | 2 +- tests/shell/testcases/transactions/0039set_0 | 2 +- 16 files changed, 32 insertions(+), 32 deletions(-) diff --git a/src/expression.c b/src/expression.c index a6065524f8be8..45f3ed8da33c0 100644 --- a/src/expression.c +++ b/src/expression.c @@ -746,7 +746,7 @@ static void set_expr_print(const struct expr *expr) { printf("{ "); compound_expr_print(expr, ", "); - printf("}"); + printf(" }"); } static void set_expr_set_type(const struct expr *expr, diff --git a/tests/shell/testcases/maps/0003map_add_many_elements_0 b/tests/shell/testcases/maps/0003map_add_many_elements_0 index a2233e3909ecd..36b1be25eb664 100755 --- a/tests/shell/testcases/maps/0003map_add_many_elements_0 +++ b/tests/shell/testcases/maps/0003map_add_many_elements_0 @@ -49,7 +49,7 @@ $NFT -f $tmpfile EXPECTED="table ip x { map y { type ipv4_addr : ipv4_addr - elements = { $(generate_test)} + elements = { $(generate_test) } } }" GET=$($NFT list ruleset) diff --git a/tests/shell/testcases/maps/0004interval_map_create_once_0 b/tests/shell/testcases/maps/0004interval_map_create_once_0 index 7d4877eb6e964..1f043875729ee 100755 --- a/tests/shell/testcases/maps/0004interval_map_create_once_0 +++ b/tests/shell/testcases/maps/0004interval_map_create_once_0 @@ -48,7 +48,7 @@ EXPECTED="table ip x { map y { type ipv4_addr : ipv4_addr flags interval - elements = { $(generate_test)} + elements = { $(generate_test) } } }" GET=$($NFT list ruleset) diff --git a/tests/shell/testcases/maps/0005interval_map_add_many_elements_0 b/tests/shell/testcases/maps/0005interval_map_add_many_elements_0 index 824f2c85fb708..4d4f708e38760 100755 --- a/tests/shell/testcases/maps/0005interval_map_add_many_elements_0 +++ b/tests/shell/testcases/maps/0005interval_map_add_many_elements_0 @@ -54,7 +54,7 @@ EXPECTED="table ip x { map y { type ipv4_addr : ipv4_addr flags interval - elements = { $(generate_test)} + elements = { $(generate_test) } } }" GET=$($NFT list ruleset) diff --git a/tests/shell/testcases/maps/0006interval_map_overlap_0 b/tests/shell/testcases/maps/0006interval_map_overlap_0 index c1bf3de111ac9..8597639ea2aaa 100755 --- a/tests/shell/testcases/maps/0006interval_map_overlap_0 +++ b/tests/shell/testcases/maps/0006interval_map_overlap_0 @@ -29,7 +29,7 @@ EXPECTED="table ip x { map y { type ipv4_addr : ipv4_addr flags interval - elements = { 10.0.1.0/24 : 10.0.0.1, 10.0.2.0/24 : 10.0.0.2} + elements = { 10.0.1.0/24 : 10.0.0.1, 10.0.2.0/24 : 10.0.0.2 } } }" GET=$($NFT list ruleset) diff --git a/tests/shell/testcases/netns/0001nft-f_0 b/tests/shell/testcases/netns/0001nft-f_0 index 663167d741c57..435275233f75d 100755 --- a/tests/shell/testcases/netns/0001nft-f_0 +++ b/tests/shell/testcases/netns/0001nft-f_0 @@ -19,12 +19,12 @@ trap "rm -rf $tmpfile" EXIT # cleanup if aborted RULESET="table ip t { set s { type ipv4_addr - elements = { 1.1.0.0} + elements = { 1.1.0.0 } } chain c { ct state new - udp dport { 12345} + udp dport { 12345 } ip saddr @s drop jump other } @@ -35,12 +35,12 @@ RULESET="table ip t { table ip6 t { set s { type ipv6_addr - elements = { fe00::1} + elements = { fe00::1 } } chain c { ct state new - udp dport { 12345} + udp dport { 12345 } ip6 saddr @s drop jump other } @@ -51,12 +51,12 @@ table ip6 t { table inet t { set s { type ipv6_addr - elements = { fe00::1} + elements = { fe00::1 } } chain c { ct state new - udp dport { 12345} + udp dport { 12345 } ip6 saddr @s drop jump other } diff --git a/tests/shell/testcases/netns/0002loosecommands_0 b/tests/shell/testcases/netns/0002loosecommands_0 index fbaa38658de6a..3910446a5565f 100755 --- a/tests/shell/testcases/netns/0002loosecommands_0 +++ b/tests/shell/testcases/netns/0002loosecommands_0 @@ -39,12 +39,12 @@ netns_exec $NETNS_NAME "$NFT add rule ip t c jump other" RULESET="table ip t { set s { type ipv4_addr - elements = { 1.1.0.0} + elements = { 1.1.0.0 } } chain c { ct state new - udp dport { 12345} + udp dport { 12345 } ip saddr @s drop jump other } diff --git a/tests/shell/testcases/netns/0003many_0 b/tests/shell/testcases/netns/0003many_0 index 17d7b93588f34..03da6eec85973 100755 --- a/tests/shell/testcases/netns/0003many_0 +++ b/tests/shell/testcases/netns/0003many_0 @@ -22,12 +22,12 @@ trap "rm -rf $tmpfile" EXIT # cleanup if aborted RULESET="table ip t { set s { type ipv4_addr - elements = { 1.1.0.0} + elements = { 1.1.0.0 } } chain c { ct state new - udp dport { 12345} + udp dport { 12345 } ip saddr @s drop jump other } @@ -38,12 +38,12 @@ RULESET="table ip t { table ip6 t { set s { type ipv6_addr - elements = { fe00::1} + elements = { fe00::1 } } chain c { ct state new - udp dport { 12345} + udp dport { 12345 } ip6 saddr @s drop jump other } @@ -54,12 +54,12 @@ table ip6 t { table inet t { set s { type ipv6_addr - elements = { fe00::1} + elements = { fe00::1 } } chain c { ct state new - udp dport { 12345} + udp dport { 12345 } ip6 saddr @s drop jump other } diff --git a/tests/shell/testcases/nft-f/0002rollback_rule_0 b/tests/shell/testcases/nft-f/0002rollback_rule_0 index 5518c0b2de46b..ddeb5423cc4c3 100755 --- a/tests/shell/testcases/nft-f/0002rollback_rule_0 +++ b/tests/shell/testcases/nft-f/0002rollback_rule_0 @@ -14,12 +14,12 @@ trap "rm -rf $tmpfile" EXIT # cleanup if aborted GOOD_RULESET="table ip t { set t { type ipv4_addr - elements = { 1.1.1.1} + elements = { 1.1.1.1 } } chain c { ct state new - tcp dport { 22222} + tcp dport { 22222 } ip saddr @t drop jump other } diff --git a/tests/shell/testcases/nft-f/0003rollback_jump_0 b/tests/shell/testcases/nft-f/0003rollback_jump_0 index 5c8c6852bc98c..6c43df9db5f82 100755 --- a/tests/shell/testcases/nft-f/0003rollback_jump_0 +++ b/tests/shell/testcases/nft-f/0003rollback_jump_0 @@ -14,12 +14,12 @@ trap "rm -rf $tmpfile" EXIT # cleanup if aborted GOOD_RULESET="table ip t { set t { type ipv4_addr - elements = { 1.1.1.1} + elements = { 1.1.1.1 } } chain c { ct state new - tcp dport { 22222} + tcp dport { 22222 } ip saddr @t drop jump other } diff --git a/tests/shell/testcases/nft-f/0004rollback_set_0 b/tests/shell/testcases/nft-f/0004rollback_set_0 index db1c84cb1b349..1dea85ec401ad 100755 --- a/tests/shell/testcases/nft-f/0004rollback_set_0 +++ b/tests/shell/testcases/nft-f/0004rollback_set_0 @@ -14,12 +14,12 @@ trap "rm -rf $tmpfile" EXIT # cleanup if aborted GOOD_RULESET="table ip t { set t { type ipv4_addr - elements = { 1.1.1.1} + elements = { 1.1.1.1 } } chain c { ct state new - tcp dport { 22222} + tcp dport { 22222 } ip saddr @t drop jump other } diff --git a/tests/shell/testcases/nft-f/0005rollback_map_0 b/tests/shell/testcases/nft-f/0005rollback_map_0 index 13bb90752ffc1..777cc7175ef10 100755 --- a/tests/shell/testcases/nft-f/0005rollback_map_0 +++ b/tests/shell/testcases/nft-f/0005rollback_map_0 @@ -14,12 +14,12 @@ trap "rm -rf $tmpfile" EXIT # cleanup if aborted GOOD_RULESET="table ip t { set t { type ipv4_addr - elements = { 1.1.1.1} + elements = { 1.1.1.1 } } chain c { ct state new - tcp dport { 22222} + tcp dport { 22222 } ip saddr @t drop jump other } @@ -31,7 +31,7 @@ GOOD_RULESET="table ip t { BAD_RULESET="flush ruleset table ip t2 { chain c2 { - tcp dport map {22222: jump other, 11111: jump invalid} + tcp dport map { 22222: jump other, 11111: jump invalid } } chain other { diff --git a/tests/shell/testcases/sets/0021nesting_0 b/tests/shell/testcases/sets/0021nesting_0 index 3bcb61473198c..763d9ae1797e6 100755 --- a/tests/shell/testcases/sets/0021nesting_0 +++ b/tests/shell/testcases/sets/0021nesting_0 @@ -33,7 +33,7 @@ fi EXPECTED="table ip x { chain y { - ip saddr { 1.1.1.0/24, 2.2.2.0/24, 3.3.3.0/24} + ip saddr { 1.1.1.0/24, 2.2.2.0/24, 3.3.3.0/24 } } }" diff --git a/tests/shell/testcases/transactions/0035set_0 b/tests/shell/testcases/transactions/0035set_0 index a014a69ecd41a..0788e2fe9489b 100755 --- a/tests/shell/testcases/transactions/0035set_0 +++ b/tests/shell/testcases/transactions/0035set_0 @@ -27,7 +27,7 @@ fi EXPECTED="table ip x { set y { type ipv4_addr - elements = { 3.3.3.3} + elements = { 3.3.3.3 } } }" diff --git a/tests/shell/testcases/transactions/0038set_0 b/tests/shell/testcases/transactions/0038set_0 index 2e36fa31d3f60..765507555814d 100755 --- a/tests/shell/testcases/transactions/0038set_0 +++ b/tests/shell/testcases/transactions/0038set_0 @@ -28,7 +28,7 @@ EXPECTED="table ip x { set y { type ipv4_addr flags interval - elements = { 192.168.4.0/24} + elements = { 192.168.4.0/24 } } }" diff --git a/tests/shell/testcases/transactions/0039set_0 b/tests/shell/testcases/transactions/0039set_0 index 2e36fa31d3f60..765507555814d 100755 --- a/tests/shell/testcases/transactions/0039set_0 +++ b/tests/shell/testcases/transactions/0039set_0 @@ -28,7 +28,7 @@ EXPECTED="table ip x { set y { type ipv4_addr flags interval - elements = { 192.168.4.0/24} + elements = { 192.168.4.0/24 } } }" -- 2.11.0 ^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [nft PATCH 3/3] sets: Fix for missing space after last element 2017-03-22 0:26 ` [nft PATCH 3/3] sets: Fix for missing space after last element Phil Sutter @ 2017-03-22 11:52 ` Pablo Neira Ayuso 0 siblings, 0 replies; 11+ messages in thread From: Pablo Neira Ayuso @ 2017-03-22 11:52 UTC (permalink / raw) To: Phil Sutter; +Cc: netfilter-devel On Wed, Mar 22, 2017 at 01:26:36AM +0100, Phil Sutter wrote: > Not having a space between the last element in a set and the closing > curly brace looks ugly, so add it here. > > This also adjusts all shell testcases as they match whitespace in nft > output and therefore fail otherwise. It's just one extra byte in the output. I don't mind, so applied this. ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [nft PATCH 1/3] tests: Add test cases for nested anonymous sets 2017-03-22 0:26 ` [nft PATCH 1/3] tests: Add test cases for nested anonymous sets Phil Sutter 2017-03-22 0:26 ` [nft PATCH 2/3] tests: shell: netns/0003many_0: Fix cleanup after error Phil Sutter 2017-03-22 0:26 ` [nft PATCH 3/3] sets: Fix for missing space after last element Phil Sutter @ 2017-03-22 11:51 ` Pablo Neira Ayuso 2 siblings, 0 replies; 11+ messages in thread From: Pablo Neira Ayuso @ 2017-03-22 11:51 UTC (permalink / raw) To: Phil Sutter; +Cc: netfilter-devel On Wed, Mar 22, 2017 at 01:26:34AM +0100, Phil Sutter wrote: > This makes sure nesting of anonymous sets works regardless of whether > defines are used or not. As a side-effect, it also checks that overlap > checking when IP address prefixes are used, works. Applied, thanks. ^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2017-03-22 12:30 UTC | newest] Thread overview: 11+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2017-03-20 16:38 [nft PATCH 0/2] Some fixes for nested sets Phil Sutter 2017-03-20 16:38 ` [nft PATCH 1/2] evaluate: set: Allow for set elems to be sets Phil Sutter 2017-03-20 16:38 ` [nft PATCH 2/2] evaluate: set: Fix nested set merge size adjustment Phil Sutter 2017-03-21 13:19 ` [nft PATCH 0/2] Some fixes for nested sets Pablo Neira Ayuso 2017-03-22 0:26 ` [nft PATCH 1/3] tests: Add test cases for nested anonymous sets Phil Sutter 2017-03-22 0:26 ` [nft PATCH 2/3] tests: shell: netns/0003many_0: Fix cleanup after error Phil Sutter 2017-03-22 8:45 ` Arturo Borrero Gonzalez 2017-03-22 11:51 ` Pablo Neira Ayuso 2017-03-22 0:26 ` [nft PATCH 3/3] sets: Fix for missing space after last element Phil Sutter 2017-03-22 11:52 ` Pablo Neira Ayuso 2017-03-22 11:51 ` [nft PATCH 1/3] tests: Add test cases for nested anonymous sets Pablo Neira Ayuso
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).